calcom/cal.diy · error · UnauthorizedException

NextAuthStrategy - User associated with the authentication t

Error message

NextAuthStrategy - User associated with the authentication token email not found.

What it means

Thrown by NextAuthStrategy.authenticate when findByEmailWithProfile(payload.email) returns null. The session decoded with an email, but no User row matches that email in the API's database.

Source

Thrown at apps/api/v2/src/modules/auth/strategies/next-auth/next-auth.strategy.ts:30

    super();
  }

  async authenticate(req: Request) {
    try {
      const nextAuthSecret = this.config.get("next.authSecret", { infer: true });
      const payload = await getToken({ req, secret: nextAuthSecret });

      if (!payload) {
        throw new UnauthorizedException("NextAuthStrategy - Authentication token is missing or invalid.");
      }

      if (!payload.email) {
        throw new UnauthorizedException("NextAuthStrategy - Email not found in the authentication token.");
      }

      const user = await this.userRepository.findByEmailWithProfile(payload.email);
      if (!user) {
        throw new UnauthorizedException(
          "NextAuthStrategy - User associated with the authentication token email not found."
        );
      }

      return this.success(user);
    } catch (error) {
      if (error instanceof Error) return this.error(error);
      return this.error(
        new InternalServerErrorException(
          "NextAuthStrategy - An error occurred while authenticating the request"
        )
      );
    }
  }
}

View on GitHub (pinned to 176037d0af)

Solutions

Re-authenticate in the current environment so a fresh session ties to an existing user.
Confirm the user exists: `SELECT id,email FROM users WHERE lower(email) = lower('<payload.email>')`.
Normalize email to lowercase on both session creation and user lookup.

Defensive patterns

Strategy: validation

Validate before calling

const user = await db.user.findFirst({ where: { email: payload.email } });
if (!user) throw new Error(`No user with email ${payload.email}; re-authenticate in this environment`);

Prevention

Normalize email to lower-case on both session creation and user storage/lookup.
Cascade-revoke sessions on user deletion.
Re-authenticate whenever switching environments or databases.

When it happens

Trigger: A request with a NextAuth session whose email belongs to a user that was deleted, never existed in this deployment, or whose email differs by case.

Common situations: Session cookie carried across deployments; user deleted after session creation; email casing mismatch (User@Example.com vs user@example.com).

Understand the failure class

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of calcom/cal.diy@176037d0af (2026-08-12). Data as JSON: /api/errors/28205eae5e315de2. Report an issue: GitHub.